Visualizando alertas para aprimorar o monitoramento de segurança em rede

Abstract

This work presents a proposal of a tool to visualize alerts, which uses a network security alerts database and visual tools that focus on visualizing data. The database can be generated by any Intrusion Detection System (IDS), but it has to export the alerts in IDMEF. For this work the chosen IDS to generate the database was Snort, because it has some configuration flexibility and supports the chosen output format. With the help of data visualizing tools, the dashboard seeks to reach a situational awareness of the network and the ability to visualize security events. The visual tools chosen were Google Visualization API and Highcharts API, both are implemented in JavaScript and provide a vast documentation of its features. The visualization enables a perception of the network current context by the analyst, and assists in the decision making. The resulting dashboard allows the analyst to see intrusion alerts with the possibility of reconcile other network info, enhancing the reply action to the intrusion.